Technical Attack Details
Cybersecurity firm Dream has detected a sophisticated cyberattack campaign targeting firewalls by exploiting a series of security vulnerabilities known as PHP2Shell. The attackers rely on combining two PHP vulnerabilities (bearing the codes CVE-2026-109618 and CVE-2026-109619) with a Linux kernel privilege escalation vulnerability known as Fragnesia (CVE-2026-46300).
The attackers used the Chinese technical asset search engine FOFA to identify 19,000 firewalls available online, filtering targets based on geographic location (United States, Japan, Taiwan, and South Korea) and the PHP versions used, which reduced the list of potential targets to 240 devices. The attackers successfully breached 25 firewalls and planted malware (Webshells) to ensure persistent access.
Why Does This News Matter?
The danger of this attack lies in the attackers' ability to move from breaching a single firewall to gaining control over the entire administrative infrastructure. In a documented case targeting a US government institution, the attackers used the breached firewall as a platform to access the internal firewall management server. This enabled them to:
- Access network settings and sensitive credentials.
- Decrypt LDAP service account passwords.
- Enumerate users and groups within the domain.
- Execute password spraying attacks and attempt to create backdoor accounts in Active Directory.
Strategic Context
Analyses indicate that these operations align with the strategic intelligence goals of Chinese state-linked actors in the Pacific region. Although the attack has not been attributed to a specific entity by name, the nature of the targets and the techniques used suggest state-sponsored technical activity, placing sensitive institutions in the targeted countries facing a security challenge that requires immediate system updates and patching of the mentioned vulnerabilities.